SC-200: Security Operations Analyst Associate | Defend against cyberthreats with Microsoft's security operations platform

SC-200 Course: Defend against cyberthreats with Microsoft's security operations platform

Learn to investigate and hunt for threats, and to respond to them, using Microsoft Sentinel, Microsoft Defender for Cloud and Microsoft 365 Defender. In this course you will learn to mitigate cyberthreats using these technologies. Specifically, you will configure and use Microsoft Sentinel, as well as the Kusto (KQL) query language, to perform detection, analysis and reporting. The course was designed for people who perform a security operations job role and helps students prepare for the SC-200: Microsoft Security Operations Analyst.

Virtual course with certification exam included as a gift. Don't miss this opportunity! The exam is valued at €126 + VAT and is included at no additional cost.

Promotion valid until December 31, 2026. One-time exam available only in Virtual - Distance Learning format.

Level: Intermediate  -  Product: Azure Microsoft 365  -  Role: Security Engineer, Security Operations Analyst

Microsoft Security Operations Analyst - Cloud Security - SOC Analyst - Microsoft Defender - Azure Sentinel - Incident Response - Threat Detection - SIEM - SOAR

Course aimed at

The Microsoft Security Operations Analyst role collaborates with the organization's stakeholders to protect the organization's information technology systems. Its goal is to reduce the organization's risks by quickly remediating active attacks in the environment, advising on improvements to threat protection procedures, and communicating policy violations to the relevant stakeholders. Among its responsibilities are the management and monitoring of threats and responding to them using different security solutions in the environment. The role is primarily concerned with investigating and detecting threats, as well as responding to them, using Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft 365 Defender, and third-party security products. Since the security operations analyst is the one who will use the operational results of these tools, they are also a key stakeholder in the configuration and implementation of these technologies.

Course objectives

• Investigate and mitigate threats: You will learn to use tools such as Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud to investigate, hunt for, and respond to threats.
  
• Configure and manage Microsoft Sentinel: You will configure your environment in Microsoft Sentinel, manage log connections, and create queries using Kusto Query Language (KQL).
  
• Manage threat mitigation: You will use Microsoft Defender XDR, Microsoft Purview, and Microsoft Defender for Endpoint to manage threat mitigation.
  
• Threat hunting: You will perform advanced threat hunting using threat intelligence and KQL for detection, analysis, and reporting.

SC-200 training elements

• SC-200: Threat mitigation using Microsoft Defender XDR (6 Modules)
• SC-200: Mitigate threats using Microsoft Security Copilot (5 Modules)
• SC-200: Threat mitigation with Microsoft Purview (4 Modules)
• SC-200: Threat mitigation with Microsoft Defender for Endpoint (9 Modules)
• SC-200: Threat mitigation with Microsoft Defender for Cloud (6 Modules)
• SC-200: Creating queries for Microsoft Sentinel using Kusto Query Language (KQL) (4 Modules)
• SC-200: Configuring the Microsoft Sentinel environment (6 Modules)
• SC-200: Connecting logs to Microsoft Sentinel (7 Modules)
• SC-200: Creating detections and performing investigations using Microsoft Sentinel (8 Modules)
• SC-200: Threat hunting in Microsoft Sentinel (4 Modules)

SC-200 course content: Defending against cyberthreats with Microsoft's security operations platform

Unit 1: Threat mitigation with Microsoft Defender XDR

Module objectives:

• Microsoft Defender XDR: Microsoft Defender XDR is a solution that helps mitigate threats and risks using various tools and features. 
  
• Threat investigation: Microsoft Defender XDR provides tools for threat investigation, including Microsoft Security Graph API and advanced search capabilities. 
  
• Incident management: Microsoft Defender XDR allows incident management, including automatic attack interruption and alert investigation. 
  
• Office 365 protection: Microsoft Defender for Office 365 provides capabilities to filter, simulate attacks, and remediate risks 
  
• Identity protection: Microsoft Defender for Identity and Entra ID Protection provide tools to protect identities, detect risks, and remediate threats
  

Lessons:

• Overview of threat protection with Microsoft Defender XDR
• Incident mitigation with Microsoft Defender XDR
  
• Risk remediation with Defender for Office 365 in Microsoft Defender XDR
  
• Microsoft Defender for Identity in Microsoft Defender XDR
  
• Identity protection with Entra ID Protection
  
• Defender for Cloud applications in Microsoft Defender XDR
  
• Course labs:
  • Lab 01: Threat mitigation with Microsoft Defender XDR

Unit 2: Introduction to Microsoft Security Copilot 

Module objectives:

• How to describe Microsoft Copilot in Microsoft Defender XDR
  
• How to describe Microsoft Copilot in Microsoft Purview
  
• How to describe Microsoft Copilot in Microsoft Entra

Lessons:

• Generative AI basics
  
• Overview of Microsoft Security Copilot
  
• Overview of Microsoft Security Copilot key features
  
• Overview of Microsoft Security Copilot integrated experiences
  

Unit 3: Threat mitigation with Microsoft Purview

Module objectives:

• Microsoft Purview: Microsoft Purview provides compliance solutions to mitigate threats 
  
• Content search: content search is a key feature in the Microsoft 365 Compliance Center for quick searches across all content 
  
• Audit solutions: Microsoft Purview provides two audit solutions: Audit (Standard) and Audit (Premium) 
  
• Audit (Standard): audit (Standard) is enabled by default and provides the capability to record and search audited activities. 
  
• Premium audit: Premium audit builds on Standard audit by providing advanced auditing features. 
  

Lessons:

• Microsoft Purview compliance solutions
• Investigation and remediation of at-risk entities identified by Microsoft Purview data loss prevention (DLP) policies
  
• Investigation and remediation of insider risk threats identified by Microsoft Purview policies
  
• Threat investigation using content search in Microsoft Purview
  
• Threat investigation using Microsoft Purview Standard Audit
  
• Threat investigation using Microsoft Purview Premium Audit
  

Unit 4: Threat mitigation with Microsoft Defender for Endpoint

Module objectives:

• Defender for Endpoint:  Microsoft Defender for Endpoint is a platform designed to help enterprise networks avoid, detect, and investigate advanced threats at their endpoints, and respond to them. 
  
• Threat management: Defender for Endpoint provides advanced attack detections that are almost real-time and actionable. 
  Device onboarding: devices can be monitored using
• Microsoft Defender for Endpoint through the Defender for Endpoint portal. 
  
• Attack surface reduction: attack surface reduction rules can be enabled on Windows devices to reduce the attack surface. 
  
• Vulnerability management: Defender Vulnerability Management uses built-in, agentless scanners to continuously monitor and detect risk in your organization, even when devices are not connected to the corporate network. 
  

Lessons:

• Threat protection with Microsoft Defender for Endpoint
  
• Deployment of the Microsoft Defender for Endpoint environment
  
• Deployment of Windows security improvements
  
• Performing device investigations
  
• Performing actions on a device
  
• Performing test and entity investigations
  
• Automation configuration and management
  
• Alert and detection configuration
  
• Use of Threat and Vulnerability Management
• Module lab:
  • Lab 01: Threat mitigation with Microsoft Defender for Endpoint

Unit 5: Threat mitigation with Microsoft Defender for Cloud

Course objectives:

• Defender for Cloud: Microsoft Defender for Cloud is a development security operations (DevSecOps) solution that unifies security management at the code level in multi-cloud environments and various pipelines 
  
• Cloud security: Microsoft Defender for Cloud offers cloud security posture management (CSPM) and a cloud workload protection platform (CWPP) 
  
• Workload protections: Microsoft Defender for Cloud offers workload protections for servers, containers, storage, databases, and other workloads 
  
• Hybrid cloud protection: Microsoft Defender for Cloud can protect hybrid cloud environments, including non-Azure machines and AWS and GCP accounts. 
  
• Alert remediation: Microsoft Defender for Cloud provides practical tasks to mitigate threats, prevent future attacks, and trigger automated responses 
  

Lessons:

• Explanation of cloud workload protections in Microsoft Defender for Cloud
  
• Connecting Azure resources to Microsoft Defender for Cloud
  
• Connecting non-Azure resources to Microsoft Defender for Cloud
  
• Cloud security posture management
  
• Microsoft Defender for Cloud workload protection
  
• Security alert remediation using Microsoft Defender for Cloud
  
• Module lab:
  • Lab 01: Threat mitigation with Microsoft Defender for Cloud

Unit 6: Creating queries for Microsoft Sentinel using Kusto Query Language (KQL)

Module objectives:

• KQL instructions: Building KQL queries for Microsoft Sentinel 
  
• KQL operators: use KQL operators such as summarize, render, union, join, and extend 
  
• KQL data extraction: extracting data from unstructured and structured string fields using KQL 
  
• KQL functions: creating functions and parsers using KQL 
  
• KQL Lab: lab exercises to create queries for Microsoft Sentinel using KQL 
  

Lessons:

• Building KQL queries for Microsoft Sentinel
  
• Using KQL to analyze query results
  
• Using KQL to create multi-table queries
  
• Working with string data using KQL queries
  
• Module labs: 
  • Lab 01: Creating queries for Microsoft Sentinel using Kusto Query Language (KQL)

Unit 7: Configuring the Microsoft Sentinel environment 

Module objectives:

• Microsoft Sentinel: Microsoft Sentinel is a scalable, cloud-native solution that provides security information and event management (SIEM) and security orchestration, automation, and response (SOAR). 
  
• Sentinel components: Microsoft Sentinel has several components, including data connectors, analyzers, workbooks, analytic rules, search queries, notebooks, incidents and investigations, automation strategy workbooks, Azure Logic Apps custom connectors, and watchlists. 
  
• Using Sentinel: Microsoft Sentinel is a solution for performing security operations in on-premises and cloud environments. It can be used to collect event data from various sources and perform security operations on that data to identify suspicious activities 
  
• Sentinel watchlists: Microsoft Sentinel watchlists can be used to investigate threats, respond quickly to incidents, import business data, reduce alert fatigue, and enrich event data 
  
• Threat intelligence: Microsoft Sentinel allows you to manage threat indicators, view, sort, filter, and search imported threat indicators, and perform daily threat intelligence management tasks.
  

Lessons:

• Introduction to Microsoft Sentinel
  
• Creating and managing Microsoft Sentinel workspaces
  
• Query logs in Microsoft Sentinel
  
• Using watchlists in Microsoft Sentinel
  
• Using threat intelligence in Microsoft Sentinel
  
• The unified security operations platform
  
• Module lab:
  • Lab 1: Configuring the Microsoft Sentinel environment

Unit 8: Connecting logs to Microsoft Sentinel

Module objectives:

• Sentinel connectors: Microsoft Sentinel provides several data connectors to connect logs and data sources 
  
• Content hub solutions: content hub solutions include data connectors, analyzers, workbooks, analytic rules, search queries, notebooks, watchlists, and strategy workbooks 
  
• Data collection rules: data collection rules (DCR) are used to manage collection at scale, improve security and performance, and save costs. 
  
• Threat intelligence: the Threat Intelligence Content Hub solution provides connectors for the TAXII platforms, Microsoft Defender Threat Intelligence, and Threat Intelligence 
  
• Microsoft Defender: Microsoft Sentinel provides built-in connectors for Microsoft Defender solutions, such as Microsoft Defender XDR, Microsoft Defender for Cloud, and Microsoft Defender for IoT
  

Lessons:

• Content management in Microsoft Sentinel
  
• Connecting data to Microsoft Sentinel using data connectors
  
• Connecting Microsoft services to Microsoft Sentinel
  
• Connecting Microsoft Defender XDR to Microsoft Sentinel
  
• Connecting Windows hosts to Microsoft Sentinel
  
• Connecting common event format logs to Microsoft Sentinel
  
• Connecting Syslog data sources to Microsoft Sentinel
  
• Connecting threat indicators to Microsoft Sentinel
  
• Module lab:
  • Lab 01: Connecting logs to Microsoft Sentinel

Unit 9: Creating detections and conducting investigations with Microsoft Sentinel

Module objectives:

• Analysis rules: Microsoft Sentinel Analytics analyzes data from multiple sources to identify correlations and anomalies. It also provides several types of analytics rules. 
  
• Automation: Microsoft Sentinel provides automation options such as automation rules and playbooks to automate incident response. 
  
• Incident management: Microsoft Sentinel provides incident management features, including alert and entity management, as well as incident investigation and resolution. 
  
• Data normalization: Microsoft Sentinel provides data normalization features, including the use of ASIM parsers and KQL functions with parameters. 
  

Lessons

• Threat detection with Microsoft Sentinel Analytics
  
• Automation in Microsoft Sentinel
  
• Threat response with Microsoft Sentinel playbooks
  
• Security incident management in Microsoft Sentinel
  
• Entity behavior analytics in Microsoft Sentinel
  
• Data normalization in Microsoft Sentinel
  
• Querying, visualizing, and monitoring data in Microsoft Sentinel
• Module lab:
  • Lab 01: Creating detections and conducting investigations with Microsoft Sentinel

Unit 10: Conducting threat hunting in Microsoft Sentinel

Module objectives:

• Threat hunting: learn how to perform threat hunting in Microsoft Sentinel using queries, bookmarks, live streaming, and MITRE ATT&CK 
  
• Hunting tools: use tools such as workbooks, hunting jobs, and external tools to hunt for threats in Microsoft Sentinel 
  
• Threat hunting hypothesis: develop a threat hunting hypothesis that is feasible, narrowly scoped, time-bound, useful, effective, and aligned with the threat model. 
  

Lessons

• Explanation of threat hunting concepts in Microsoft Sentinel
  
• Threat hunting with Microsoft Sentinel
  
• Using hunting jobs in Microsoft Sentinel
  
• Optional: threat hunting with workbooks in Microsoft Sentinel
  
• Module lab: 
  • Lab 1: Threat hunting in Microsoft Sentinel

Prerequisites

• Basic knowledge of Microsoft Defender
• Basic knowledge of Microsoft identity, compliance, and security products
• Intermediate knowledge of Windows 11, Linux, and Windows Server
• Familiarity with Microsoft Azure and Microsoft Defender portals and services
• Familiarity with Azure Monitoring and Azure Log Analytics
• Familiarity with Azure virtual machines
• Basic knowledge of scripting concepts
  

Language

• Course: English / Spanish
• Labs: English / Spanish

Microsoft Associate Certification: Security Operations Analyst Associate

Microsoft Certified: Security Operations Analyst Associate

Manage security operations environments. Configure protections and detections. Manage incident responses. Perform threat hunting

Level: Intermediate
Role: Security Engineer, Security Operations Analyst
Product: Azure, Microsoft 365
Subject: Security

Related Microsoft certification: Cybersecurity Architect Expert

Complete a prerequisite:

• Microsoft Certified: Azure Security Engineer Associate (AZ-500 Microsoft Azure Security Technologies)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300: Microsoft Identity and Access Administrator)
• Microsoft Certified: Security Operations Analyst Associate (SC-200: Microsoft Security Operations Analyst Associate)

Take an exam:

• Microsoft Cybersecurity Architect (SC-100: Microsoft Cybersecurity Architect)

Earn the certification:

• Microsoft Certified: Cybersecurity Architect Expert